- Sandboxed private source downloads cannot read tokens stored by `gh`
in the macOS Keychain. Allowing Keychain access would also expose
unrelated credentials, so retain the existing sandbox restrictions.
- Reuse `GitHub::API.github_cli_token` outside the sandbox for built-in
Git strategies when the rewritten URL uses HTTPS on `github.com`
and a credential helper is configured. Bound the lookup and keep
configured helpers inside the sandbox, including wrappers of `gh`.
- Pass the result as `GH_TOKEN` only to top-level clones, fetches and
remote branch discovery. Register it for log redaction without
setting the parent environment or populating the API credential
cache, avoiding exposure through formula environment variables.
- Disable implicit submodule recursion even when Git configuration
enables it, so child downloads cannot inherit the top-level token.
Fetch submodules separately without it. Checkouts, resets and local
inspections also receive no injected token. Share the recursion flag,
working-directory selection and timeout conversion across callers.
- Explain why tap operations can use Keychain helpers while source
downloads cannot, and document the remaining authentication limits
for private submodules and partial clones that fetch during checkout.
Fixes#24339
Mike McQuaid
a48f3f21ac